hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 13:15:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add taint test

Browse Source
This commit is contained in:
Joe Farebrother
2025-11-24 16:54:21 +00:00
parent a83c70f99d
commit b0be8184ac
5 changed files with 68 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
python/ql/lib/semmle/python/frameworks/Socketio.qll
View File

@@ -30,6 +30,15 @@ module SocketIO {
private class EventHandler extends Http::Server::RequestHandler::Range {
EventHandler() {
serverEventAnnotation().getAValueReachableFromSource().asExpr() = this.getADecorator()
or
exists(DataFlow::CallCfgNode c, DataFlow::Node arg | c = server().getMember("on").getACall() |
(
arg = c.getArg(1)
or
arg = c.getArgByName("handler")
) and
poorMansFunctionTracker(this) = arg
)
}
override Parameter getARoutedParameter() {
@@ -44,20 +53,13 @@ module SocketIO {
exists(DataFlow::CallCfgNode c | c = server().getMember(["emit", "send"]).getACall() |
this = c.getArgByName("callback")
)
or
exists(DataFlow::CallCfgNode c | c = server().getMember("on").getACall() |
this = c.getArg(1) or
this = c.getArgByName("handler")
)
}
}
private class CallbackHandler extends Http::Server::RequestHandler::Range {
CallbackHandler() { any(CallbackArgument ca) = poorMansFunctionTracker(this) }
override Parameter getARoutedParameter() {
result = this.getAnArg() and not result = this.getArg(0)
}
override Parameter getARoutedParameter() { result = this.getAnArg() }
override string getFramework() { result = "socketio" }
}